lssas.dll infected with win32/psw.qqrob.naq virus

Discussion in 'NOD32 version 2 Forum' started by dsi-ap, Aug 20, 2007.

Thread Status:
Not open for further replies.
  1. dsi-ap

    dsi-ap Registered Member

    Joined:
    Jul 4, 2005
    Posts:
    118
    Location:
    UK
    Hi all
    I have a workstation that is now reporting the lssas.dll file to be infected with win32/psw.qqrob.naq virus.
    The atatched screenshot shows the infection and NOD32 unable to remove it as its in use already.
    After booting into safemode and trying doing another in-depth anaylis no infected files where found. While in safemode went directly to the system32 folder and deleted the lsass.dll file.

    Booted into windows as normal, started the scan and again the lsass.dll file was found by NOD to be infected.

    I will be taking the HDD out the case and set it as a slave to scan from another system.

    Can someone make sense whats happening here?
     

    Attached Files:

  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,375
    Have you tried deleting it in safe mode? If it doesn't help, try using the Undll tool.
     
  3. dsi-ap

    dsi-ap Registered Member

    Joined:
    Jul 4, 2005
    Posts:
    118
    Location:
    UK
    Thanks for the response Marco.
    I did delete the file in safemode, so unsure why it is still re-generated back.
    How do i use undll, and what is it for?
     
  4. Thanasis159

    Thanasis159 Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    86
    Try deactivating System Restore and then do another full scan in safe mode!
     
  5. dsi-ap

    dsi-ap Registered Member

    Joined:
    Jul 4, 2005
    Posts:
    118
    Location:
    UK
    Running windows 2000 pro, so no sys restore.
    Thanks for the feedback tho, appreciate it.
     
  6. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,375
    I'd suggest that you send a log from Autoruns to support[at]eset.com with this thread's url in the subject.
     
  7. dsi-ap

    dsi-ap Registered Member

    Joined:
    Jul 4, 2005
    Posts:
    118
    Location:
    UK
    Autoruns.txt file sent to NOD.
    Thanks
     
Thread Status:
Not open for further replies.